NEW YORK STATE SECURITY BREACH REPORTING FORM 

Pursuant to the Information Security Breach and Notification Act 
(General Business Law §899-aa) 


Name and address of Entity that owns or licenses the computerized data that was subject to the breach : 

Outten & Golden LLP 

Street Address: 3 Park Avenue. 29 lh Floor 

City: New York State: NY Zip Code: 10016 


Submitted by : lason A. Bernstein Title: Attorney Dated: lulv 6, 2016 
Firm Name (if other than entity): Barnes & Thornburg LLP 

Telephone: 404-264-4040 Email: jason.bemstein@btlaw.com 

Relationship to Entity whose information was compromised: Attorney for Outten & Golden LLP 


Type of Organization (please select one): [ ] Governmental Entity in New York State; [ ] Other Governmental Entity; 
[ | Educational; [ ]Health Care; [ ]Financial Services; [ XJOther Commercial; or [ ]Not-for-profit. 


Number of Persons Affected : 

Total (Including NYS residents): 157 NYS Residents: 103 

If the number of NYS residents exceeds 5,000, have the consumer reporting agencies been notified? [ | Yes | | No 


Dates : Breach Occurred: lune 18. 2016 Breach Discovered: lune 18. 2016 Consumer Notification: lune 19. 2016 


Description of Breach (please select all that apply): 

| [Loss or theft of device or media (e.g., computer, laptop, external hard drive, thumb drive, CD, tape); 

[ [Internal system breach; [ [Insider wrongdoing; [ [External system breach (e.g., hacking); 

[ X [Inadvertent disclosure ; [X]Other specify): Employee was a victim of a spoof and sent a file with the W2 
information of the firm's employees to an unauthorized email address 


Information Acquired : Name or other personal identifier in combination with (please select all that apply): 
[XJSocial Security Number 

[ [Driver's license number or non-driver identification card number 

[ [Financial account number or credit or debit card number, in combination with the security code, access code, 
password, or PIN for the account 


Manner of Notification to Affected Persons - ATTACH A COPY OF THE TEMPLATE OF THE NOTICE TO 
AFFECTED NYS RESIDENTS: 

[ X [ Written [ X ] Electronic [ [ Telephone [ [ Substitute notice 

List dates of any previous (within 12 months) breach notifications: _ 


Identify Theft Protection Service Offered : [X[Yes [ | No 
Duration: 12 months Provider: AllClearlD 

Brief Description of Service: Credit monitoring; the firm is also reimbursing employees for the cost of freezing credit. 
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TEXT OF COMMUNICATION SENT TO AFFECTED INDIVIDUALS 


Dear O&Gers, 

We value and respect the privacy of your personal information. Therefore, we are writing to 
inform you of an incident involving some of that information, what that means to you, how we 
are actively addressing the situation, and what you might do to protect yourself. 

The Facts As We Currently Know Them 

Late Friday afternoon, June 17, 2016, the firm learned that, as a result of a spoofing attack, 
your W2-related information has been compromised and accessed by unauthorized persons. 
As soon as we became aware of the incident, we started addressing the situation. 

First, we sent an email late Friday afternoon to O&GAll about the episode. Subsequently, we 
retained counsel who are experienced in dealing with such situations. The incident and 
pertinent details are being reported to the appropriate agencies, and we are fully cooperating 
with them. We are sending this information via email today; we will be sending it again via 
mail on Monday. 

We believe that fewer than 200 current and former employees may have been affected. While 
we are unable to determine exactly the extent to which the information has been accessed 
and/or used, we have received at least one report of an employee's information being used 
improperly. 

What Type of Information Was Involved? 

The information that may have been accessed included identifying personal information, such 
as name, address, and social security number. 

Steps You Should Take to Protect Yourself 

Because the firm takes the protection of your personal security very seriously, we are offering 
free credit monitoring services. We are contracting with a credit monitoring service to offer 
you 12 months of services at no cost to you. This product helps detect possible misuse of your 
personal information and provides you with identity protection support focused on immediate 
identification and resolution of identity theft. We will provide a follow up letter shortly that will 
include instructions for contacting the service provider. Lastly, see the enclosed information for 
additional steps you should take to protect yourself. 

Contact Information 

If you have any questions, please contact: 

Victoria Spencer Patterson, Director of Administration 
Outten & Golden LLP 

3 Park Ave, 29th Floor, New York, NY 10016 
Phone: 646-825-9807 
Fax: 646-509-2082 
Email: vsp@outtengolden.com 



We apologize for any inconvenience this may have caused. Be assured that we have been working, 
and will continue working, diligently to avoid and mitigate any harm to you. 

Sincerely, 

Wayne N. Outten 
Managing Partner 



STEPS YOU CAN TAKE TO FURTHER PROTECT YOURSELF 


We are providing this explanation of steps you can take to protect your information. As a 
precautionary measure, we recommend that you remain vigilant for incidents of fraud and 
identity theft by reviewing your account statements and credit reports closely. You may obtain 
a free copy of your credit report from each of the three major credit reporting agencies listed 
below once every 12 months by visiting http://www.annualcreditreport.com or calling toll- 
free 877-322-8228. You can also report any fraudulent activity or any suspected identity theft 
to proper law enforcement authorities, your state attorney general and/or the Federal Trade 
Commission. To file a complaint about identity theft with the FTC or to learn more, go to 
www.ftc.gov/idtheft. call 1-877-ID-THEFT (877-438-4338). 

Fraud Alert 


We suggest you consider placing a fraud alert on your credit report. An initial fraud alert is 
free and will stay on your credit file for at least 90 days. The alert informs creditors of possible 
fraudulent activity within your report and requests that the creditor contact you prior to 
establishing any accounts in your name. If you would like to place a fraud alert on your credit 
report, contact any of the three credit reporting agencies using the contact information below. 
The Federal Trade Commission has a good website with an overview and guidance on this 
issue at https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs . You can also contact 
them at: Federal Trade Commission or write to: Federal Trade Commission, 600 Pennsylvania 
Avenue, NW, Washington, DC 20580. Or, call 1-877-ID-THEFT. 

Security Freeze Information 

In some US states, you have the right to place a security freeze on your credit file. This will 
prevent new credit from being opened in your name without the use of a PIN number that is 
issued to you when you initiate the freeze. You can obtain further information regarding 
security freezes from the FTC and from any of the three credit reporting agencies listed below. 


Equifax 

(800) 685-1111 
www.equifax.com 

P.0. Box 740241 
Atlanta, GA 30374 


Experian 

(888) 397-3742 

www.experian.com 

P.O. Box 9532 
Allen, TX 75013 


TransUnion 
(800) 916-8800 
www.transunion.com 

P.O. Box 105281 
Atlanta, GA 30348 


Maryland Residents 

Visit the Maryland Office of the Attorney General website at 
www.oag.state.md.us/idtheft/index.htm . Call 1-410-528-8662 or write to: Consumer 
Protection Division, Maryland Office of the Attorney General, 200 St. Paul Place, Baltimore, MD 
21202 


North Carolina Residents 


Visit the North Carolina Office of the Attorney General at http://www.ncdoi.gov/Crime.aspx 
Call 1-919-716-6400 or write to: Attorney General’s Office, 9001 Mail Service Center, Raleigh, 
NC 27699-9001 
















California Residents 


State law requires us to inform you that law enforcement did not ask us to delay notification to 
you. 

IRS Tax Return Information 

If you suspect that a fraudulent tax return has or may be filed using your social security 
number, you should contact the IRS and file a complaint immediately. For more information, 
see https://www.irs.gov/uac/taxpaver-guide-to-identitv-theft . If you receive a letter from the 
IRS indicating that there has been fraudulent activity, see the information at 
https://idverify.irs.gov/lE/e-authenticate/welcome.do . The TurboTax website also has good 
information at https://turbotax.intuit.com/tax-tools/tax-tips/General-Tax-Tips/ldentitv- 
Theft—What-to-Do-if-Someone-Has-Already-Filed-Taxes-Using-Your-Social-Security- 

Number/lNF23035.html . 









